[CY-2528] support more bandit configuration files

[fmigneault]

It would be great for codacy to support [bandit] section in setup.cfg file and alternatively [tool.bandit] in pyproject.toml file.
The detected configuration files at the moment (.bandit and bandit.yml) are most definitely less often used in repos than the setup.cfg/pyproject.toml variants as they are employed to combine settings for many such static analysis/testing tools.

[mrfyda]

Seems like support for pyproject.toml configuration is still under development on bandit itself: PyCQA/bandit#550.

Let's wait for it to be completed upstream.

[fmigneault]

Since pyproject.toml support could take a while until is it completed, is it possible to consider doing a first pass for setup.cfg? Codacy bandit reports many 'problems' because it doesn't use my ignore specifications from the setup.cfg.

[mrfyda]

Since the setup.cfg is quite common and not necessarily used as a bandit configuration file, I'm concerned with it wrongly being picked up for most users.

☝️I will however consider your feedback to another feature: being able to customise the configuration file being used - since that would cover your use case.

[github-actions]

Internal ticket created : CY-2528

[machadoit]

Hi @fmigneault

Will close this ticket as will track this internally as a feature request to be prioritised accordingly. Thanks for reaching out